Privacy Policy

• We collect business contact details and order history. We do not collect patient information of any kind.
• We run no analytics, no advertising trackers, and no third-party scripts on this site.
• We use cookies only to sign you in, keep you safe, remember that you use Face ID here, and remember which of our sales reps sent you, if one did. None of them follows you anywhere.
• We do not sell your information, and we do not share it for advertising.

VitalMed Supply LLC, a Wyoming limited liability company, distributing medical supplies to pharmacies and clinics. Our mailing address is 12810 S Date St, Jenks, OK 74037. If you have a question about this policy or about information we hold, email sales@vitalmed.supply or call 479.790.8684.

If you contact us through this site, we collect your name, your company, your email address, and optionally your phone number, which products you are interested in, and whatever you write in the message box.

If you open an account on this site, we collect your name, your business name and the kind of business it is, your work email, and optionally your phone number and state. If you arrived through one of our sales reps’ links, we record which rep, so your account is assigned to them.

If your business has a portal account, we hold your name and work email, your company’s billing and shipping details, the pricing agreed with your account, and the history of what you have ordered.

Automatically, we record the IP address of requests to our sign-in, sign-up and contact endpoints, purely to limit how often those can be hit. Those records are deleted after twenty-four hours and are not used to build any profile of you.

From Avellum Health Group, we receive counts of the patient boxes packed at Precision Pharma, a pharmacy we supply, and of the orders and renewals behind those boxes, so we can plan the supplies it will need. Each delivery holds counts for each week, or for the moment they were taken; when Avellum Health Group read them; whether each was counted from records or estimated; and short codes that say which of its feeds a count came from, qualify a count, or stand in for one that is missing. It also carries, for each of those feeds, when it was last read and whether it could be, and the time the delivery was sent with a random reference for it. Deliveries come weekly, and daily once Avellum Health Group’s daily feed runs. Each is signed, so we can tell it came from Avellum Health Group. We check every delivery on arrival, refuse any that carries patient, order, product or price detail, and discard any field we do not recognize. We send nothing back but an acknowledgement. Only VitalMed administrators can see these figures.

We do not collect patient information. We supply consumables such as syringes, vials, and alcohol pads. Nothing in our portal asks for, stores, or transmits protected health information, and you should never send us any.

We do not use passwords and we do not store any. Signing in sends a six-digit code to your work email, which expires after ten minutes and can only be used once. Your session is held as a cookie whose value we store only as an irreversible hash, so a copy of our database would not let anyone sign in as you.

You can also choose to sign in with Face ID, Touch ID, a fingerprint reader or another passkey on your own device. Your face or fingerprint never leaves that device and we never receive it: the device makes a key pair, keeps the private half to itself, and gives us only the public half, with a rough name for the device (such as “iPhone”) and when it was added and last used. You can remove one at any time from Sign-in options, and the emailed code always still works.

Staff sessions end after twelve hours without use, and in any case within seven days of the last activity we saw. Customer sessions end thirty days after their last use, because re-authenticating a pharmacy buyer every week is friction without a matching security benefit. Deactivating a login ends its sessions immediately.

Four, each set only for the job named below. None is used for analytics or advertising, which is why this site has no cookie banner asking you to accept anything optional.

• vm_session keeps you signed in. It cannot be read by JavaScript and is sent only to this site.
• qbo_oauth_state exists for fifteen minutes while an administrator connects our QuickBooks integration, and protects that step from being triggered by another website.
• vm_rep is set only if you follow one of our sales reps’ sign-up links. It holds that rep’s link code for thirty days so an account you open is assigned to them, and nothing else. It cannot be read by JavaScript and is sent only to this site.
• vm_passkey is set once you use Face ID, Touch ID or a passkey here, so the sign-in page can offer it first next time. It says only that, not who you are.

We run no analytics and no advertising or social media trackers. No third-party script loads on this site at all.

With your authorization, we connect to your QuickBooks Online company to keep our records and your accounting in step. This connection is approved by someone with administrator rights on your QuickBooks and can be disconnected at any time, from your side or ours.

Through that connection we read:

• Your item records, from which we use and keep the names, codes, purchase costs, sales prices, and quantities on hand.
• Your company name, legal name, and country, which we use only to confirm the connection is working.

When an order ships, we create the matching invoice in your books, so what you sold and what your accounting says stay in step. When one of our administrators adds a product to our catalog and chooses to add it to QuickBooks, we create that item in your books with the same code and name, using the same accounts and tax setting as a similar item you already have, with no sales price and no stock on hand. Nothing is added to your books on a schedule or without someone choosing it. We store a cached copy of the item information above so that browsing a catalog does not make a call to Intuit on every page view. We hold access tokens for the connection in our database, never in a browser.

Disconnecting stops all future access immediately, and we delete the stored connection tokens at that point. You can disconnect from your side in QuickBooks under connected apps, or ask us and we will do it and revoke our own access. Item details already copied into our catalog are part of our business records and are kept under the rest of this policy.

We do not use QuickBooks data for advertising, we do not sell it, and we do not share it with anyone outside the service providers listed below.

We use a small number of service providers to run the platform. They process information on our instructions and for no purpose of their own.

• Vercel, which hosts this website and the portal (United States).
• Neon, which hosts our database (United States).
• Resend, which delivers our email, including sign-in codes and order notifications.
• Intuit, for the QuickBooks connection described above, where your business has authorized one.
• ShipStation, for shipping labels and tracking, once shipping runs through it.
• Anthropic, which provides the AI model behind an assistant our administrators use in the back office. When an administrator asks it about accounts, orders or pricing, the details it looks up to answer, and any file the administrator attaches, are sent to Anthropic for that answer. Customers never talk to it, and it cannot change anything.

We may also disclose information if the law requires it, or to protect the rights and safety of our customers and our business.

We do not sell personal information and we do not share it for cross-context behavioral advertising.

We do not currently accept card payments through this portal, and we do not store card numbers anywhere. If that changes, payment details will be handled by a payment processor and this policy will be updated before the feature goes live.

We email you to run your account: sign-in codes, order notifications, and replies to inquiries you send us. If you write to us through the contact form, our sales team will follow up with you; that is what the form is for.

We do not send marketing email. If that ever changes, every marketing message will include a working unsubscribe link and our mailing address, and opting out will never affect the account emails you need.

Order records, invoices, and the account history behind them are kept for as long as we do business together and afterwards for as long as tax and commercial record-keeping obligations require. Website inquiries are kept while we follow them up and while the business relationship they may lead to continues. The counts from Avellum Health Group are kept as a record of what was received. Rate-limiting records containing IP addresses are deleted after twenty-four hours. Sign-in codes expire in ten minutes.

Traffic to this site is encrypted in transit, and our hosting and database providers encrypt what they store at rest. Sign-in session tokens are stored only as hashes, so they cannot be recovered from our records. Access to customer accounts is limited to the people at your business you ask us to give access to, and administrative accounts are created only from a command line by our own team, never through a web form. Deactivating a login ends any session it already had.

If a security incident affects your information, we will notify you as the law requires, and sooner where we can.

No system is perfectly secure, and we do not claim otherwise. If you believe an account has been compromised, contact us immediately at sales@vitalmed.supply.

You can ask us what information we hold about you, ask us to correct it, or ask us to delete it, and we will do so unless we are required to keep it for tax or legal reasons. You can ask us to remove a portal login at any time. Depending on where you live, the law may give you additional rights over your information. Where a privacy law applies to us and to you, we will honor it.

Email sales@vitalmed.supply to make a request. We may need to confirm who you are first.

This is a service for businesses. It is not directed at children, and we do not knowingly collect information from any child under thirteen. If you believe a child has given us information, tell us and we will delete it.

If we change this policy we will update the date at the top, and where the change is significant we will tell account holders by email rather than relying on you to notice.

See also our Terms of Service.